Websites hit by mass attack
An attack on websites, first reported by
security researcher Dancho Danchev, has expanded to hit over a million
web pages, including many well-known sites

The number and importance of the sites has increased," wrote Danchev in a blog post, where he reported that the websites for USAToday and Walmart were among those hit by the attack.

The criminals behind this have not actually hacked into servers, but
they are taking advantage of web programming errors to inject malicious
code into search results pages created by the websites" internal search
engines.

Here"s how an attack would work: the attacker searches for popular
keywords, such as "Paris Hilton," on the website"s internal search
engine. But instead of conducting a normal search, the bad guy tacks an
HTML command to the end of his search. This command that opens up an
invisible iFrame window in the victim"s browser that then redirects it
to a malicious site, which then tries to install fake anti-spyware or a
version of the Zlob Trojan Horse malware on the victim"s PC.

In order to boost their Google rankings, websites often save a copy
of these search results and submit them to Google. When a victim
searches Google for the keyword, these cached search results then pop
up, with the malicious code now inside them.

"Malicious parties are actively poisoning these sites search query
caching feature to position the keywords among the top ten search
results, thereby infecting anyone coming across them," said Danchev, in
an instant-message interview.

He believes that over one million web pages have been infected using this technique.